{"api_version":"1","generated_at":"2026-11-11T00:13:52+00:00","cve":"CVE-2026-123787","urls":{"html":"https://cve.report/CVE-2026-123787","api":"https://cve.report/api/cve/CVE-2026-123787.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-123787","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-123787"},"summary":{"title":"nexmoe VidBee Local HTTP Service local-api.ts information disclosure","description":"A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component.","state":"PUBLISHED","assigner":"VulDB","published_at":"2026-11-06 21:17:07","updated_at":"2026-11-09 14:17:13"},"problem_types":["CWE-200","CWE-284","CWE-200 Information Disclosure","CWE-284 Improper Access Controls"],"metrics":[{"version":"4.0","source":"cna@vuldb.com","type":"Secondary","score":"2.1","severity":"LOW","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","data":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"}},{"version":"3.1","source":"cna@vuldb.com","type":"Secondary","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","data":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","version":"3.1"}},{"version":"3.0","source":"CNA","type":"DECLARED","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","data":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","version":"3.0"}},{"version":"2.0","source":"cna@vuldb.com","type":"Secondary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"CNA","type":"DECLARED","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C","data":{"baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C","version":"2.0"}}],"references":[{"url":"https://github.com/nexmoe/VidBee/issues/468","name":"https://github.com/nexmoe/VidBee/issues/468","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/nexmoe/VidBee/commit/141b8d39c1c11da4589264f814cee077df81e7f6","name":"https://github.com/nexmoe/VidBee/commit/141b8d39c1c11da4589264f814cee077df81e7f6","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://drive.google.com/drive/folders/14oKqKWtHM7oCUMEDYidrp1ETGk0hWKTh","name":"https://drive.google.com/drive/folders/14oKqKWtHM7oCUMEDYidrp1ETGk0hWKTh","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/vuln/431933","name":"https://vuldb.com/vuln/431933","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/nexmoe/VidBee/","name":"https://github.com/nexmoe/VidBee/","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/nexmoe/VidBee/releases/tag/v2.2.0","name":"https://github.com/nexmoe/VidBee/releases/tag/v2.2.0","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/cve/CVE-2026-123787","name":"https://vuldb.com/cve/CVE-2026-123787","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/vuln/431933/cti","name":"https://vuldb.com/vuln/431933/cti","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/submit/1009701","name":"https://vuldb.com/submit/1009701","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123787","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123787","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.0","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.1","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.2","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.3","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.4","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.5","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.6","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.7","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.8","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.9","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.10","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.11","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.12","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 1.3.13","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 2.0.0","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 2.0.1","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"affected 2.0.2","platforms":[]},{"source":"CNA","vendor":"nexmoe","product":"VidBee","version":"unaffected 2.2.0","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-11-06T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"source":"CNA","time":"2026-11-06T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"source":"CNA","time":"2026-11-06T18:05:08.000Z","lang":"en","value":"VulDB entry last update"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Notwo1f","lang":"en"},{"source":"CNA","value":"researchersongwu (VulDB User)","lang":"en"},{"source":"CNA","value":"researchersongwu (VulDB User)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"123787","cve":"CVE-2026-123787","epss":"0.003380000","percentile":"0.273680000","score_date":"2026-11-09","updated_at":"2026-11-10 00:05:34"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-123787","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T13:25:11.442368Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-09T13:25:23.806Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:nexmoe:vidbee:*:*:*:*:*:*:*:*"],"modules":["Local HTTP Service"],"product":"VidBee","vendor":"nexmoe","versions":[{"status":"affected","version":"1.3.0"},{"status":"affected","version":"1.3.1"},{"status":"affected","version":"1.3.2"},{"status":"affected","version":"1.3.3"},{"status":"affected","version":"1.3.4"},{"status":"affected","version":"1.3.5"},{"status":"affected","version":"1.3.6"},{"status":"affected","version":"1.3.7"},{"status":"affected","version":"1.3.8"},{"status":"affected","version":"1.3.9"},{"status":"affected","version":"1.3.10"},{"status":"affected","version":"1.3.11"},{"status":"affected","version":"1.3.12"},{"status":"affected","version":"1.3.13"},{"status":"affected","version":"2.0.0"},{"status":"affected","version":"2.0.1"},{"status":"affected","version":"2.0.2"},{"status":"unaffected","version":"2.2.0"}]}],"credits":[{"lang":"en","type":"finder","value":"Notwo1f"},{"lang":"en","type":"reporter","value":"researchersongwu (VulDB User)"},{"lang":"en","type":"analyst","value":"researchersongwu (VulDB User)"}],"descriptions":[{"lang":"en","value":"A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component."}],"metrics":[{"cvssV4_0":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"}},{"cvssV3_1":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","version":"3.1"}},{"cvssV3_0":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","version":"3.0"}},{"cvssV2_0":{"baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C","version":"2.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"Information Disclosure","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-284","description":"Improper Access Controls","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-06T21:00:26.229Z","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB"},"references":[{"name":"VDB-431933 | nexmoe VidBee Local HTTP Service local-api.ts information disclosure","tags":["vdb-entry"],"url":"https://vuldb.com/vuln/431933"},{"name":"VDB-431933 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/431933/cti"},{"name":"CVE-2026-123787 | CVE Analysis and Report","tags":["third-party-advisory"],"url":"https://vuldb.com/cve/CVE-2026-123787"},{"name":"Submit #1009701 | nexmoe  VidBee  2.0.2 unauthentication lead to sensitive information leakage,operation","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/1009701"},{"tags":["issue-tracking"],"url":"https://github.com/nexmoe/VidBee/issues/468"},{"tags":["exploit"],"url":"https://drive.google.com/drive/folders/14oKqKWtHM7oCUMEDYidrp1ETGk0hWKTh"},{"tags":["patch"],"url":"https://github.com/nexmoe/VidBee/commit/141b8d39c1c11da4589264f814cee077df81e7f6"},{"tags":["patch"],"url":"https://github.com/nexmoe/VidBee/releases/tag/v2.2.0"},{"tags":["product"],"url":"https://github.com/nexmoe/VidBee/"}],"tags":["x_open-source"],"timeline":[{"lang":"en","time":"2026-11-06T00:00:00.000Z","value":"Advisory disclosed"},{"lang":"en","time":"2026-11-06T01:00:00.000Z","value":"VulDB entry created"},{"lang":"en","time":"2026-11-06T18:05:08.000Z","value":"VulDB entry last update"}],"title":"nexmoe VidBee Local HTTP Service local-api.ts information disclosure","x_generator":["VulDB PVTS v202611"]}},"cveMetadata":{"assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","assignerShortName":"VulDB","cveId":"CVE-2026-123787","datePublished":"2026-11-06T21:00:26.229Z","dateReserved":"2026-11-06T14:44:08.210Z","dateUpdated":"2026-11-09T13:25:23.806Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-06 21:17:07","lastModifiedDate":"2026-11-09 14:17:13","problem_types":["CWE-200","CWE-284","CWE-200 Information Disclosure","CWE-284 Improper Access Controls"],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-09T13:25:11.442368Z","id":"CVE-2026-123787","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"123787","Ordinal":"1","Title":"nexmoe VidBee Local HTTP Service local-api.ts information disclo","CVE":"CVE-2026-123787","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"123787","Ordinal":"1","NoteData":"A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component.","Type":"Description","Title":"nexmoe VidBee Local HTTP Service local-api.ts information disclo"}]}}}